{"id":244561,"date":"2018-01-13T15:30:57","date_gmt":"2018-01-13T13:30:57","guid":{"rendered":"https:\/\/mybroadband.co.za\/news\/?p=244561"},"modified":"2018-01-13T15:34:06","modified_gmt":"2018-01-13T13:34:06","slug":"how-to-assess-a-vendors-data-security","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/244561-how-to-assess-a-vendors-data-security.html","title":{"rendered":"How to assess a vendor&#8217;s data security"},"content":{"rendered":"<p dir=\"ltr\"><em>By EFF Deeplinks Blog.<\/em><\/p>\n<p dir=\"ltr\">Perhaps you\u2019re an office manager tasked with setting up a new email system for your nonprofit, or maybe you\u2019re a legal secretary for a small firm and you\u2019ve been asked to choose an app for scanning sensitive documents: you might be wondering how you can even begin to assess a tool as \u201csafe enough to use.\u201d<\/p>\n<p dir=\"ltr\">This post will help you think about how to approach the problem and select the right vendor.<\/p>\n<p dir=\"ltr\">As every organization has unique circumstances and needs, we can\u2019t provide definitive software recommendations or provider endorsements. However, we can offer some advice for assessing a software vendor and for gauging their claims of protecting the security and privacy of your clients and your employees.<\/p>\n<p dir=\"ltr\">If you are signing up for a service where you will be storing potentially sensitive employee or client data, or if you are considering using a mobile or desktop application which will be handling client or employee data, you should make sure that the company behind the product or service has taken meaningful steps to secure that data from misuse or theft, and that they won\u2019t give the data to other parties\u2014including governments or law enforcement\u2014without your knowledge.<\/p>\n<p dir=\"ltr\">If you are the de facto IT person for a small organization\u2014but aren\u2019t sure how to evaluate software before adopting it\u2014here are some questions you can ask vendors before choosing to buy their software. (For the purposes of this post, we will be focusing on concerns relating to the confidentiality of data, as opposed to the integrity and availability of data.)<\/p>\n<p dir=\"ltr\">If the company can\u2019t or won\u2019t answer these questions, they are asking you to trust them based on very little evidence: this is not a good sign.<\/p>\n<h3 dir=\"ltr\">General things to keep in mind<\/h3>\n<h4 dir=\"ltr\">When you\u2019re researching vendors, consider the following:<\/h4>\n<ul>\n<li>Have there been past security issues with or criticisms of the tool?<\/li>\n<li>If so, how quickly have they responded to criticisms about their tool? How quickly have they patched or made updates to fix vulnerabilities? Generally companies should provide updates to vulnerable software as quickly as possible, but sometimes\u00a0<a href=\"https:\/\/www.eff.org\/deeplinks\/2017\/05\/why-patching-problem-makes-us-wannacry\">actually getting the updated software can be difficult.<\/a>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li>Note that criticisms and vulnerabilities are not necessarily a bad sign for the company, as even the most carefully-built software can have vulnerabilities. What\u2019s more important is that the company takes security concerns seriously, and fixes them as quickly as possible.<\/li>\n<\/ul>\n<\/li>\n<li>Of course, companies selling products and enthusiasts advertising their latest software can be misled, be misleading, or even outright lie. A product that was originally secure might have terrible flaws in the future.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<ul>\n<li>Do you have a plan to stay well-informed on the latest news about the tools that you use?\n<ul>\n<li>Setting up a Google alert for \u201c[example product] data breach flaw vulnerability\u201d is one way to find out about problems with a product that you use, though it probably won\u2019t catch every problem.<\/li>\n<li>You can also follow tech news websites or social media to keep up with information security news. You can check the \u201c<a href=\"https:\/\/sec.eff.org\/blog\">Security News<\/a>\u201d section of the\u00a0<a href=\"https:\/\/sec.eff.org\/\">Security Education Companion<\/a>, which curates EFF Deeplinks posts relevant to software vulnerabilities, as well as other considerations for people teaching digital security to others.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<ul>\n<li>Is this vendor honest about the limitations of their product?<\/li>\n<\/ul>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li>If a vendor makes claims like\u00a0<a href=\"https:\/\/medium.com\/@mshelton\/developing-security-skepticism-3ec9b5df09fb\">\u201cNSA-Proof\u201d or \u201cMilitary Grade Encryption\u201d<\/a>without stating what the security limitations of the product are, this can be a sign that the vendor is overconfident in the security of their product. A vendor should be able to clearly state the situations that their security model doesn\u2019t defend against.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<ul>\n<li>Does the company provide a guarantee about the availability of your data?\n<ul>\n<li>This is sometimes called a \u201cService Level Agreement\u201d (SLA).<\/li>\n<li>How likely is it that this company is going to stick around? Does it seem like they have sustainable business practices?<\/li>\n<li>If the service disappears, is there a way to access your data and move it to another service provider or app? Or will it be gone forever?<\/li>\n<li>Is there any chance that they will\u00a0<a href=\"https:\/\/consumerist.com\/2012\/06\/13\/paypal-bans-you-for-life-wont-tell-you-why\/\">ban you from using their app or service<\/a>, and thus also lock you out from accessing your data? Think about if there are any limits to how the service can be used.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h4 dir=\"ltr\">Questions to ask the vendor:<\/h4>\n<p dir=\"ltr\">Note that you may not be able to hit all of the following points\u2014however, asking these questions will give you a better sense of what to expect from the service.<\/p>\n<ul>\n<li>Does the vendor have a privacy policy on their website? Do they share or sell data to any third parties?\n<ul>\n<li>If you have the means to chat with a lawyer while reviewing the privacy policy, you can ask about:\n<ul>\n<li>Notification: Do they promise to notify us of any legal demand before handing over any of our data, or data about us (with no exceptions)?<\/li>\n<li>Viewing: Do they promise not to look at our data themselves, except when they absolutely need to?<\/li>\n<li>Sharing: Do they require anyone who they share the data with to abide by the same privacy policy and notification terms?<\/li>\n<li>Restriction: Are they only using the data for the purpose of which they provided?<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<li>Will the vendor disclose any client data to their partners or other third parties in the normal course of business? If so, are those conditions clearly stated? What are the privacy practices of those other entities?<\/li>\n<li>Does the vendor follow current best practices in\u00a0<a href=\"https:\/\/www.eff.org\/who-has-your-back-government-data-requests-2015#best-practices\">responding to government requests<\/a>in your jurisdiction?\n<ul>\n<li>Do they require a warrant before handing over user content?<\/li>\n<li>Do they publish regular transparency reports?<\/li>\n<li>Do they publish law enforcement guides?<\/li>\n<\/ul>\n<\/li>\n<li>Do they have a dedicated security team? If so, what is their\u00a0<a href=\"https:\/\/www.forbes.com\/sites\/christieterrill\/2017\/05\/31\/how-to-plan-for-security-incident-response\/#44841ff45bc8\">incident response plan<\/a>? Do they have any specifics about responding to breaches of data security?<\/li>\n<li>Have they had a recent security audit? If there were any security issues found, how quickly were they fixed?<\/li>\n<li>How often do they get security audits? Will they share the results, or at least share an executive summary?<\/li>\n<li>What measures do they take to secure private data from theft or misuse?<\/li>\n<li>Have they had a data breach? (This is not necessarily a bad thing, especially if they have a plan for how to prevent them in the future. This is really about what was breached\u2014 for example, was it a contact list from a webform, or their health information files?)\n<ul>\n<li>If they had a data breach in the past, what measures have they taken to prevent a data breach in the future?<\/li>\n<\/ul>\n<\/li>\n<li>How does the company notify customers about data breaches?<\/li>\n<li>Does the vendor give advance notice when it changes its data practices?<\/li>\n<li>Does the vendor encrypt data in transit? Do they default to secure connections? (For example, does a website redirect an unencrypted HTTP website to an encrypted HTTPS site?) \u00a0What is the vendor\u2019s disaster recovery plan and backup scheme?<\/li>\n<li>What internal controls exist for vendor\u2019s staff accessing logs, client data and other sensitive information?<\/li>\n<li>Does this service allow\u00a0<a href=\"https:\/\/ssd.eff.org\/en\/module\/how-enable-two-factor-authentication\">two-factor authentication<\/a>\u00a0on login?\n<ul>\n<li>If not, why not? How soon do they plan to implement it?<\/li>\n<\/ul>\n<\/li>\n<li>Do they push regular software updates?<\/li>\n<\/ul>\n<h4 dir=\"ltr\">While many companies don\u2019t yet do this, it is still good to ask:<\/h4>\n<ul>\n<li>Do they encrypt stored data? (This is also called \u201cencrypted at rest.\u201d For example, when it\u2019s \u201cin the cloud\u201d\/on their computers, is it encrypted?)<\/li>\n<li>Do they have a\u00a0<a href=\"https:\/\/en.wikipedia.org\/wiki\/Bug_bounty_program\">bug bounty<\/a>\u00a0program? If they do not have a bug bounty program in place, how do they respond to vulnerability reports? (If they are hostile to security researchers, this is a bad sign.)<\/li>\n<\/ul>\n<h4>If the service is free&#8230;<\/h4>\n<p dir=\"ltr\">It is often said that \u201cif the software is free, then you are the product\u201d\u2014this is true of any company that has targeted advertising as a business model. This is even true of the free products that nonprofits use. For this reason, free services and apps should be treated with extra caution. If you are pursuing a free service, in addition to asking the questions above, you will want to consider the following additional points.<\/p>\n<ul>\n<li>How does the vendor make money? Do they make money by selling access to\u2014or products based on\u2014your private data?<\/li>\n<li>Will they respond to customer service requests?<\/li>\n<li>How likely are they to invest in security infrastructure?<\/li>\n<\/ul>\n<h4 dir=\"ltr\">If your organization has legally-mandated requirements for protecting data&#8230;<\/h4>\n<ul>\n<li>If your organization has a unique legal circumstance (e.g. needing to abide by attorney-client privilege, HIPAA requirements for those in the medical profession, COPPA and FERPA for working with K-12 students), ask:\n<ul>\n<li>Is the client data being stored and transmitted in accordance with the legally mandated standards of your field?<\/li>\n<li>How often do they re-audit that they are in compliance with these standards?<\/li>\n<li>Are the audit results publicly available?<\/li>\n<\/ul>\n<\/li>\n<li>If you use education technology or if you work with youth under 18 years old, consider following up with this series of questions for K-12 software vendors: check out\u00a0<a href=\"https:\/\/www.eff.org\/wp\/school-issued-devices-and-student-privacy#stakeholders\">EFF\u2019s white paper on student privacy and recommendations for school stakeholders<\/a>.<\/li>\n<\/ul>\n<p>These questions do not on their own guarantee that the vendor or product will be perfectly private or secure, but that\u2019s not a promise any vendor or software can make (and if they did, it would be a red flag). However, the answers to these questions should at least give you some idea of whether the vendor takes security and privacy seriously or not, and can therefore help you make an informed decision about whether use their product. For more information about considerations for smaller organizations evaluating tools, check out\u00a0<a href=\"https:\/\/ecl.gy\/vendor-sec\">Information Ecology\u2019s Security Questions for Providers<\/a>.<\/p>\n<p><a href=\"https:\/\/www.eff.org\/deeplinks\/2018\/01\/how-assess-vendors-data-security\" target=\"_blank\" rel=\"noopener\">EFF<\/a><\/p>\n<h3 class=\"my-4\">Now read:\u00a0<a href=\"https:\/\/mybroadband.co.za\/news\/security\/244460-skype-launches-private-conversations.html\" rel=\"bookmark\">Skype launches Private Conversations<\/a><\/h3>\n","protected":false},"excerpt":{"rendered":"<p>When you\u2019re researching vendors, there are many factors to consider.<\/p>\n","protected":false},"author":23,"featured_media":213534,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_sma_x_autopost_status":"idle","_sma_x_autopost_error":"","_sma_x_post_id":"","_sma_facebook_post_id":"","_sma_instagram_post_id":"","_sma_threads_post_id":"","_sma_x_attempts":0,"footnotes":""},"categories":[27],"tags":[35,3522],"class_list":["post-244561","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-headline","tag-it"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/244561"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/23"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=244561"}],"version-history":[{"count":1,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/244561\/revisions"}],"predecessor-version":[{"id":244573,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/244561\/revisions\/244573"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/213534"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=244561"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=244561"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=244561"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}